Q1. Which framework is MOST commonly used for enterprise risk management?
- A.NIST CSF✓ Correct
- B.MITRE ATT&CK
- C.ISO 27001
- D.PCI DSS
Explanation: NIST Cybersecurity Framework (CSF) is widely adopted for risk management. Learn more.
CompTIA SecurityX Practice Questions: Risk Management
5 free, exam-style CompTIA SecurityX (CAS-005) practice questions covering Risk Management. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.
Q2. What is the PRIMARY purpose of a Business Impact Analysis (BIA)?
- A.Identifying critical systems✓ Correct
- B.Penetration testing
- C.Network segmentation
- D.Log analysis
Explanation: A BIA identifies essential functions for disaster recovery planning. Learn more.
Q3. What does risk appetite define for an organization?
- A.The amount and type of risk leadership is willing to accept✓ Correct
- B.The list of open TCP ports
- C.The number of firewall rules allowed
- D.The encryption key length only
Explanation: Risk appetite is a leadership-level statement of acceptable risk in pursuit of business objectives. Learn more.
Q4. What is the main value of a control gap assessment?
- A.Identify differences between current controls and required controls✓ Correct
- B.Assign IP addresses faster
- C.Replace incident response
- D.Increase screen brightness
Explanation: A gap assessment compares current control maturity against standards, requirements, or desired states. Learn more.
Q5. Which metric measures how often a loss event is expected to occur in a year?
- A.ARO✓ Correct
- B.RTO
- C.RPO
- D.MTTR
Explanation: Annualized rate of occurrence estimates how frequently a risk event may happen per year. Learn more.